3153e210d8912d0f8c0478b9e893bd2751d77e68b7959d1042394ad9c905fe8b

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_fc40cf387bd17193ef303ad310a20ea8_elex_mafia_stealc_tofsee.exe
Size 705KB
Sample260629-bdmv8aaz8m
SHA256 3153e210d8912d0f8c0478b9e893bd2751d77e68b7959d1042394ad9c905fe8b
MD5 fc40cf387bd17193ef303ad310a20ea8
SHA1 708275f14de9001af3662591e34092012e170e9e
SHA512 a15123995eb1a537de203abed63a402c05afe985e51a1d93508a98f00a25fdd753e1e5f2b5de0f46c4e0011494a18083312cd76eac94580da71a2d6ccbe0649f
SSDEEP 12288:+O4rfItL8HPICbcJqQQXxOZur1Ig5J7u1YyFgn/5G:+O4rQtGPPcJqbXx4uBrJa9Fg/5G
TLSH
T17EE4C020F784C13AC1572274199EE6B8D2ACE53547A0E0C7EB98CF6F6E942D1DF3065A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1192	C79.tmp

Executes dropped EXE 1 IoCs

pid	Process
1192	C79.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_fc40cf387bd17193ef303ad310a20ea8_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C79.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5452 wrote to memory of 1192	5452	2026-06-27_fc40cf387bd17193ef303ad310a20ea8_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-27_fc40cf387bd17193ef303ad310a20ea8_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_fc40cf387bd17193ef303ad310a20ea8_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5452
- C:\Users\Admin\AppData\Local\Temp\C79.tmp
  "C:\Users\Admin\AppData\Local\Temp\C79.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-27_fc40cf387bd17193ef303ad310a20ea8_elex_mafia_stealc_tofsee.exe C7FA8AF26376C53E8C18849B6741F545C46BDD367919BFDE5BD0D2788AADC65939C64942A3091D666336ADDC9666F14183E2475957E60E1E7E64D1C5F5D35B38
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C79.tmp

Path C:\Users\Admin\AppData\Local\Temp\C79.tmp
Size 705KB
SHA256 9162247a678ffc829751032a0b5e720b0732d9cdc0cf299f918d24e75d25a379
MD5 7d9949e22fc126e0c029c786b281b44e
SHA1 b61d5cfae9ef17838415ac857715ef6698152e49
SHA512 8295eea8d7459e9e645ffb0f3bfab571644f416b8c78b549ecbd2ebc787af615b514a60c991527a75993851a90bec6a77de91200afee58abc76492497e84e9d1
SSDEEP 12288:+O4rfItL8HPz4W/P2r7DebP5WD07u1YyFgn/5G:+O4rQtGPseqvebBWD0a9Fg/5G
TLSH
T1E4E4C021F784C13AC1572234295EA6B8D2ACE5354790E0C7EB99CF6F2ED42D1EF3065A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download